CVE-2026-64139

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak exists in the ksmbd module within the set posix acl entries dacl() function. The issue occurs when the system detects a DACL (Discretionary Access Control List) size overflow. While guards were implemented to prevent the size from wrapping past 65535, the break statements used to exit the ACE-building loops bypass the kfree() calls intended to release the smb sid structure allocated via kmalloc obj(). A malformed file with excessive POSIX ACL entries can trigger this overflow, leading to kernel memory exhaustion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.